[instructions] Sync github-agentic-workflows.md with release v0.40.1

[github-actions]

Instructions Update - Synchronized with v0.40.1

This PR updates github-agentic-workflows.md based on documentation and code changes since the v0.40.1 release (2026-02-03).

Changes Made

• create-pull-request: Added github-token-for-extra-empty-commit field and a CI Triggering note explaining that GITHUB_TOKEN does not trigger CI on created PRs, and documenting the GH_AW_CI_TRIGGER_TOKEN magic secret as a zero-config alternative
• push-to-pull-request-branch: Added github-token-for-extra-empty-commit field and brief CI trigger note referencing GH_AW_CI_TRIGGER_TOKEN
• messages: Added four previously undocumented message template fields:
  • activation-comments — set to "false" to disable all activation/fallback comments
  • pull-request-created — custom message on PR creation (placeholders: {item_number}, {item_url})
  • issue-created — custom message on issue creation (placeholders: {item_number}, {item_url})
  • commit-pushed — custom message on commit push (placeholders: {commit_sha}, {short_sha}, {commit_url})

Documentation Commits Reviewed

• d1ca1c6 🔐 Refactor auth docs and add GH_AW_CI_TRIGGER_TOKEN magic secret support (🔐 Refactor auth docs and add GH_AW_CI_TRIGGER_TOKEN magic secret support #17990)

Code Files Audited

• pkg/workflow/compiler_types.go — SafeOutputsConfig and SafeOutputMessagesConfig structs
• pkg/workflow/safe_outputs_config.go — safe-output YAML parsing
• pkg/workflow/create_pull_request.go — CreatePullRequestsConfig (found github-token-for-extra-empty-commit)
• pkg/workflow/push_to_pull_request_branch.go — PushToPullRequestBranchConfig (found github-token-for-extra-empty-commit)
• pkg/workflow/github_token.go — GH_AW_CI_TRIGGER_TOKEN magic secret fallback logic
• pkg/workflow/compiler_safe_outputs_job.go — CI trigger token usage
• pkg/parser/schemas/main_workflow_schema.json — JSON Schema validation

Validation

• Followed prompting best practices (imperative mood, minimal examples)
• Maintained technical tone and brevity
• Updated only necessary sections
• Verified accuracy against current codebase
• No outdated or redundant content added

Generated by Instructions Janitor

• expires on Feb 26, 2026, 12:01 AM UTC

[github-actions]

Pull request created: #17996

[Copilot]

Pull request overview

This PR updates the github-agentic-workflows.md instruction file to synchronize with the v0.40.1 release, documenting new fields and magic secret support introduced in PR #17990.

Changes:

• Added github-token-for-extra-empty-commit field to create-pull-request and push-to-pull-request-branch configurations for CI triggering
• Added documentation for the GH_AW_CI_TRIGGER_TOKEN magic secret as a CI triggering mechanism
• Added four previously undocumented message template fields: activation-comments, pull-request-created, issue-created, and commit-pushed

Comments suppressed due to low confidence (1)

.github/aw/github-agentic-workflows.md:732

• Similar to the issue on line 470, the documentation states that setting the GH_AW_CI_TRIGGER_TOKEN magic secret enables CI triggering, but this is incomplete. Based on the code, you must explicitly set github-token-for-extra-empty-commit: "default" to use the GH_AW_CI_TRIGGER_TOKEN secret. The secret is not automatically used just by being set in GitHub Secrets.

The documentation should clarify that the magic secret requires setting github-token-for-extra-empty-commit: "default" in the workflow configuration. The example on line 730 should also show the "default" option.

    Not supported for cross-repository operations. To trigger CI on pushed commits, use `github-token-for-extra-empty-commit` or set the magic secret `GH_AW_CI_TRIGGER_TOKEN`.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The documentation states that the GH_AW_CI_TRIGGER_TOKEN magic secret is "automatically used without requiring explicit configuration in the workflow," but this is inaccurate.

Based on the code in pkg/workflow/compiler_safe_outputs_job.go (lines 413-429), the GH_AW_CI_TRIGGER_TOKEN is only used when github-token-for-extra-empty-commit is explicitly set to "default". If the field is not set or is empty, no CI trigger token is used.

The documentation should clarify that to use GH_AW_CI_TRIGGER_TOKEN, you need to set github-token-for-extra-empty-commit: "default" in your workflow configuration. Additionally, the example on line 465 should include a comment showing this "default" option alongside the PAT and "app" options.

This issue also appears on line 732 of the same file.

Suggested change

	github-token-for-extra-empty-commit: ${{ secrets.MY_CI_PAT }} # Optional: PAT or "app" to trigger CI on created PRs
	```
	**Auto-Expiration**: The `expires` field auto-closes PRs after a time period. Supports integers (days) or relative formats (2h, 7d, 2w, 1m, 1y). Minimum duration: 2 hours. Only for same-repo PRs without target-repo. Generates `agentics-maintenance.yml` workflow.
	**CI Triggering**: By default, PRs created with `GITHUB_TOKEN` do not trigger CI workflow runs. To trigger CI, set `github-token-for-extra-empty-commit` to a PAT with `Contents: Read & Write` permission, or to `"app"` to use the configured GitHub App. Alternatively, set the magic secret `GH_AW_CI_TRIGGER_TOKEN` to a suitable PAT — this is automatically used without requiring explicit configuration in the workflow.
	github-token-for-extra-empty-commit: ${{ secrets.MY_CI_PAT }} # Optional: PAT, "app", or "default" (uses GH_AW_CI_TRIGGER_TOKEN) to trigger CI on created PRs
	```
	**Auto-Expiration**: The `expires` field auto-closes PRs after a time period. Supports integers (days) or relative formats (2h, 7d, 2w, 1m, 1y). Minimum duration: 2 hours. Only for same-repo PRs without target-repo. Generates `agentics-maintenance.yml` workflow.
	**CI Triggering**: By default, PRs created with `GITHUB_TOKEN` do not trigger CI workflow runs. To trigger CI, set `github-token-for-extra-empty-commit` to a PAT with `Contents: Read & Write` permission, or to `"app"` to use the configured GitHub App. Alternatively, define the magic secret `GH_AW_CI_TRIGGER_TOKEN` as a suitable PAT and set `github-token-for-extra-empty-commit: "default"` in your workflow configuration to use it. If `github-token-for-extra-empty-commit` is not set or is empty, no CI trigger token is used.